hacking: security in practice
word file hack?

im not a hacker but a quick question to you hackers, is there a way to access someone else’s word files from my laptop? i want to access my teachers files and want the answers to my exercises :)

submitted by /u/ResponsibleMuscle521
[link] [comments]

hacking: security in practice
How’s Web 3.0 Going to be different?

It’s quite obvious that Tech powerhouses control and exploit user-generated data in Web 2.0. Everyone one knows that and can accurately decipher this exploitation techniques. End users will have complete control of the data they utilize in blockchain-powered web3

You will be able to pick what information you wish to share with businesses and advertising agencies in order to earn money which is I believe has been a huge Achilles Heel for privacy breeches in Web 2.0.

Furthermore, Web3 will not be controlled by a single body. As a consequence, decentralized apps (dApps) will not be banned or limited in any way.

Searching and connecting information efficiently

Web3 will allow you to search for information more effectively. When you search for anything on a search engine, it will provide more relevant results rather than the most popular pages that people click. The semantic web will aid in improving the interconnectedness of online data.

It will assist you in becoming more productive and saving time when looking for information.

However, various technologies such as blockchain, AI, and machine learning power Web3. It will make use of semantic data, 3D graphics, and more. Likely, less advanced devices will not be able to handle Web3. Users will need a device that has above-average specifications to use Web3.

submitted by /u/Communitybot1
[link] [comments]

hacking: security in practice
How often does malware not end up running the payload in it's own EXE or DLL?

What I'm trying to figure out is how often is malware in its entirety, for example: an infected PDF, a browser exploit, Javascript, or office macros, etc.

Is it even possible in most circumstances to embed the WHOLE virus in something like that? And if so, does it still need to extract into an EXE or DLL in the end?

To put it simply, does malware still, in the end, need to execute it's own process?

(I should be clear that I'm specifically talking about Windows malware.)

submitted by /u/HalcyonicFrankfurter
[link] [comments]

BlackStone - Pentesting Reporting Tool
http://www.kitploit.com/2022/08/blackstone-pentesting-reporting-tool.html

BlackStone project or "BlackStone Project" is a tool created in order to automate the work of drafting and submitting a report on audits of ethical hacking (https://www.kitploit.com/search/label/Hacking) or pentesting. In this tool we can register in the database the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) that we find in the audit, classifying them by internal, external audit or wifi, in addition, we can put your description and recommendation, as well as the level of severity and effort for its correction. This information will then help us generate in the report a criticality table as a global summary of the vulnerabilities found. We can also register a company and, just by adding its web page, the tool will be able to find subdomains, telephone numbers, social networks, employee emails...

Docker Install Install Docker Install docker-compose Install BlackStone git clone https://github.com/micro-joan/BlackStone
cd BlackStone
docker-compose up -d
User: blackstone Password: blackstone Manual Install First we must download an Apache (https://www.kitploit.com/search/label/Apache) server to host the tool, in my case I use Mamp (I recommend following these steps): https://www.mamp.info/en/downloads/ We will download the content of this repository and we will have 2 folders (BlackStone and BBDD) Once the server starts we will go to c://MAMP/htdocs and paste all the contents of the downloaded folder "BlackStone" For the application to work we will have to import the database, we will go to our browser and write "localhost/phpMyAdmin/", you have the database connection file in the folder BlackStone/conexion.php We will create a database called blackstone and import the data from the downloaded BBDD folder Log in to BlackStone with the username (https://www.kitploit.com/search/label/Username) and password "blackstone" Use First you need to go to profile settings and add Hunter.io and haveibeenpwned.com tokens:

After having vulnerabilities in the database, we will go to the audited client and we will register a client along with their web page, once registered we can go to customer details and we can see the following information: THE USE OF THIS APPLICATION IS FOR PROFESSIONAL USE, THE AUTHOR IS NOT RESPONSIBLE FOR A MISUSE EMPLOYED
Name of business owner Social networks of the company owner Email and telephone number of the owner of the company Exposed password check on the company owner's deep web Subdomains of the website (https://www.kitploit.com/search/label/Website) as well as information of interest found in google Emails of company workers

Once we have the company that we are going to audit registered in the database, we will create a report, adding the date, name of the report and the company to which will be audited. When we register the report, we will give it edit and then we will select the vulnerabilities that we want to appear in the report:

Finally, we will generate the report by clicking on the "overview report" button, and later we will save the page that is generated as ".mht", then we will open it with Word to be able to work on the generated report:

Download BlackStone (https://github.com/micro-joan/BlackStone)

XXE Attack : Real life attacks and code examples
https://medium.com/@pentesterclubpvtltd/xxe-attack-real-life-attacks-and-code-examples-9976b6d90491?source=rss------bug_bounty-5

XXE (XML External Entity Injection) is a web-based security vulnerability that enables an attacker to interfere with the processing of XML…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/xxe-attack-real-life-attacks-and-code-examples-9976b6d90491?source=rss------bug_bounty-5)

Practical XPath Injection : Attack and Defense Techniques
https://medium.com/@pentesterclubpvtltd/practical-xpath-injection-attack-and-defense-techniques-d0b8d5502dce?source=rss------bug_bounty-5

Practical XPath Injection ExploitsContinue reading on Medium » (https://medium.com/@pentesterclubpvtltd/practical-xpath-injection-attack-and-defense-techniques-d0b8d5502dce?source=rss------bug_bounty-5)

Introduction Session Hijacking
https://medium.com/@pentesterclubpvtltd/introduction-session-hijacking-36be01472680?source=rss------bug_bounty-5

Session hijacking is defined as taking over an active TCP/IP communication session without the user’s permission. When implemented…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/introduction-session-hijacking-36be01472680?source=rss------bug_bounty-5)

XXE Attack : Real life attacks and code examples

XXE (XML External Entity Injection) is a web-based security vulnerability that enables an attacker to interfere with the processing of XML…Continue reading on Medium »
Read more...

Practical XPath Injection : Attack and Defense Techniques

Practical XPath Injection ExploitsContinue reading on Medium »
Read more...